Re: Landlock setup

["Mickaël Salaün" <mic@digikod.net>]

On 08/11/2022 12:27, Yves Rutschle wrote:
> On Mon, Nov 07, 2022 at 07:02:04PM +0100, Mickaël Salaün wrote:
>> This is correct, but you may also want to enable other LSMs if you are using
>> them (e.g. Yama). You should probably stick to the new default Debian Sid
>> cmdline: https://salsa.debian.org/kernel-team/linux/-/commit/1ef40f40e593a5dc223e9ce171fa8f2cd5aba198
> 
> I'm on Debian 11 on this PC, which enables... nothing.

Right, but it doesn't hurt to stick to the future default. :)

> 
>> Your setup is good and it should work. You can debug a bit more with an
>> up-to-date strace (which will print the Landlock syscalls). I guess you are
>> running this sample in a strict seccomp environment that denies Landlock
>> syscalls. This may be the result of using an old container runtime (Docker,
>> Podman and runc are now patched but the related fix may not be backported).
> 
> strace:
> 
> [...]
> mprotect(0x7f5189b04000, 16384, PROT_READ) = 0
> mprotect(0x558557b7c000, 4096, PROT_READ) = 0
> mprotect(0x7f5189b5c000, 8192, PROT_READ) = 0
> munmap(0x7f5189b15000, 94575)           = 0
> [ Process PID=3958 runs in x32 mode. ]
> syscall_0x400001bc(0, 0, 0x1, 0, 0x7f5189b3d2b0, 0x40) = -1 ENOSYS (Function not implemented)
> [ Process PID=3958 runs in 64 bit mode. ]
> dup(2)                                  = 3
> [...]
> 
> => I guess strace is not up to date. I dont think I have
> seccomp enabled either, and I think it would interrupt (as
> in kill) the syscall rather than return ENOSYS. I am not
> running from a docker either.

If you see "landlock: Up and running." in the running kernel log, I 
don't see any reason why the kernel would return ENOSYS for the Landlock 
syscalls.

The default kernel for Debian 11 is Linux 5.10, which doesn't support 
Landlock. I tested with linux-image-5.18.0-0.deb11.4-amd64 and 
linux-image-6.0.0-0.deb11.2-amd64-unsigned and it works fine.

On which architecture are you?

> 
> 
> Ok, so I guess I'll look into upgrading the kernel and
> strace, or compiling it myself.

No need to update strace to debug this issue, it will just not print the 
syscall names and not format their arguments.

> 
> Cheers,
> Y.
>